commit ec090f9c44460676cc5760c309cbee0eba92de9a
author Paul Miller <paulmiller@google.com> Mon May 18 11:16:19 2015 -0700
committer Paul Miller <paulmiller@google.com> Mon May 18 11:16:19 2015 -0700
tree 5a68adeb39589a18990954c5068e817b72d5bc34
parent 17ba7411ec56e29d11ceb75e620ba86ac43fa95e

Don't view images with src="javascript:..."

BUG:19296937

cherry-pick of 0d75bdd4654a2352df68709c04c773d383a58054 from master

Change-Id: Ic3597a22a3b0c1f90cdd737e735904beaf35a58e

src/com/android/browser/Controller.java

diff --git a/src/com/android/browser/Controller.java b/src/com/android/browser/Controller.java
index 3e4ae66..934f70f 100644
--- a/src/com/android/browser/Controller.java
+++ b/src/com/android/browser/Controller.java
@@ -151,6 +151,13 @@
     // "no-crash-recovery" parameter in intent to suppress crash recovery
     final static String NO_CRASH_RECOVERY = "no-crash-recovery";
 
+    // Only view images using these schemes
+    private static final String[] IMAGE_VIEWABLE_SCHEMES = {
+        "http",
+        "https",
+        "file"
+    };
+
     // A bitmap that is re-used in createScreenshot as scratch space
     private static Bitmap sThumbnailBitmap;
 
@@ -1409,7 +1416,12 @@
                         .setOnMenuItemClickListener(new OnMenuItemClickListener() {
                     @Override
                     public boolean onMenuItemClick(MenuItem item) {
-                        openTab(extra, mTabControl.getCurrentTab(), true, true);
+                        if (isImageViewableUri(Uri.parse(extra))) {
+                            openTab(extra, mTabControl.getCurrentTab(), true, true);
+                        } else {
+                            Log.e(LOGTAG, "Refusing to view image with invalid URI, \"" +
+                                    extra + "\"");
+                        }
                         return false;
                     }
                 });
@@ -1429,6 +1441,16 @@
         mUi.onContextMenuCreated(menu);
     }
 
+    private static boolean isImageViewableUri(Uri uri) {
+        String scheme = uri.getScheme();
+        for (String allowed : IMAGE_VIEWABLE_SCHEMES) {
+            if (allowed.equals(scheme)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     /**
      * As the menu can be open when loading state changes
      * we must manually update the state of the stop/reload menu